CVE-2025-1571: Exclusive Addons for Elementor XSS Vulnerability

CVE-2025-1571 Overview

CVE-2025-1571 is a Stored Cross-Site Scripting (XSS) vulnerability in the Exclusive Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 2.7.6 and resides in the plugin's Animated Text and Image Comparison widgets. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79 and received a CVSS 3.1 score of 5.4.

Critical Impact
Authenticated contributors can persist malicious JavaScript into pages, enabling session theft, administrator account takeover, and redirection of site visitors.

Affected Products

Exclusive Addons for Elementor (free, WordPress) — all versions through 2.7.6
Animated Text widget component
Image Comparison widget component

Discovery Timeline

2025-02-28 - CVE-2025-1571 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1571

Vulnerability Analysis

The vulnerability is a stored XSS flaw introduced by the plugin's handling of widget attributes supplied through the Elementor page editor. The Animated Text and Image Comparison widgets accept user-controlled attribute values and render them into page markup without sufficient sanitization during input or escaping during output. A contributor-level user who can edit posts can embed JavaScript payloads inside widget attributes. When any site visitor or logged-in administrator loads a page containing the malicious widget, the browser executes the injected script in the context of the WordPress site origin.

Because the vulnerability is persistent and triggered through normal page views, it affects any role that can be socially engineered into visiting the page, including administrators. Successful exploitation can enable session hijacking, forced actions through the WordPress REST API, defacement, and redirection to attacker-controlled infrastructure.

Root Cause

The root cause is missing or inadequate input sanitization and output escaping on attributes consumed by the Animated Text and Image Comparison widgets. WordPress provides native escaping helpers such as esc_attr(), esc_html(), and wp_kses() for exactly this purpose. The vulnerable widget render functions did not apply these controls consistently to all attribute values before echoing them into HTML.

Attack Vector

Exploitation requires an authenticated account with contributor-level privileges or higher on a WordPress site running the vulnerable plugin. The attacker edits or creates a post containing an affected widget and supplies a crafted attribute value that includes a script payload. User interaction is required to trigger execution, limited to any user navigating to the page. The attack is network-reachable and the scope is changed because the injected script executes under the WordPress origin, impacting other users.

No verified public proof-of-concept code is available. For technical remediation details, see the WordPress Plugins Changeset 3245128 and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-1571

Indicators of Compromise

Post or page content containing <script> tags, javascript: URIs, or event-handler attributes such as onerror= and onload= within Elementor widget data
Unexpected outbound requests from browsers viewing pages to unfamiliar third-party domains
New or modified administrator accounts following contributor activity on pages using Animated Text or Image Comparison widgets

Detection Strategies

Inspect the wp_postmeta table for Elementor data entries containing script tags or HTML event handlers inside widget attributes
Review audit logs for post edits by contributor-level accounts that add or modify Animated Text or Image Comparison widgets
Scan rendered pages with headless-browser tooling to flag inline scripts not sourced from trusted plugin or theme assets

Monitoring Recommendations

Enable WordPress audit logging to track post revisions, user role changes, and plugin edits
Deploy a Web Application Firewall (WAF) with rules for stored XSS payloads targeting Elementor widget attributes
Monitor browser Content Security Policy (CSP) violation reports for unexpected inline script execution

How to Mitigate CVE-2025-1571

Immediate Actions Required

Update Exclusive Addons for Elementor to the latest version released after 2.7.6 on all affected WordPress sites
Audit contributor, author, and editor accounts, removing stale or unknown users and resetting credentials where abuse is suspected
Review all pages built with the Animated Text and Image Comparison widgets and remove any suspicious attribute content

Patch Information

The vendor addressed the vulnerability in a release that corrects input sanitization and output escaping on the affected widget attributes. Refer to the WordPress Plugins Changeset 3245128 for the committed fix and to the plugin's official download page for the latest version.

Workarounds

Restrict the contributor role or disable it on sites that do not require guest authoring
Temporarily deactivate the Exclusive Addons for Elementor plugin until the patched version is deployed
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads

bash

# Example: enforce a restrictive CSP via Apache or Nginx
# Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"

# Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;